LANSING, MI – A recent audit found some holes in the Michigan Unemployment Insurance Agency’s security controls that protect sensitive information.
The state’s Office of the Auditor General laid out six findings in a May 17 audit on the agency’s two key systems—MiDAS, an information system that collects unemployment taxes and pays benefits, and MiWAM, an online system where people can file unemployment claims.
It found the Michigan UIA did not always protect federal tax information, which is “critically important” for taxpayer confidentiality, as required by the IRS. Auditors sampled 330 employees or contractors who could view sensitive tax data and found the UIA did not perform background checks for 80% of them.
Related: Michigan unemployment agency hired some ‘high-risk’ workers with criminal records, audit finds
Additionally, as the Michigan UIA rushed to onboard more contractors during the COVID-19 pandemic, it did not remove employee access to MiDAS in a timely manner. Auditors, looking at a sample of 61 users, found 69% of them still had access to the system within 72 hours of leaving the agency.
“Delayed removal can result in unauthorized access to MiDAS, allowing users the ability to view confidential information, change or update claim information, and process inappropriate claims,” the audit said.
The Michigan UIA did not have effective “access controls” over MiDAS, according to the audit, which increased the risk of unauthorized access to unemployment insurance data.
“UIA informed us it did not maintain effective access controls because of the COVID-19 pandemic-related workload and the need to onboard an unprecedented number of new staff in a very short time period,” the audit said.
From March 2020 through June 2021, MiDAS processed $36.5 billion in unemployment claims, and the agency has spent $60.8 million on developing and maintaining the system.
This report follows a December 2021 audit that found the agency overpaid $3.9 billion in federal pandemic benefits and a March audit that found the agency hired “high-risk” workers with past financial crimes.
In response to the report, Michigan UIA Director Julia Dale said the agency is taking steps to “bolster our security practices” to protect personal information about claimants and businesses.
“The Michigan Unemployment Insurance Agency has made significant operational changes over the past six months to enhance responsiveness and problem-solving. After more than a decade of disinvestment in UIA, there is still more work to do,” Dale said in a statement.
Some recent actions include requiring criminal history checks and fingerprinting on everyone who has access to confidential information, updating the process to remove user access to MiDAS and granting access to MiDAS based on individual job requirements.
“With these changes, UIA has in place robust policies and practices that we are confident we will begin to restore the public’s confidence in our agency,” Dale said.
The audit took place between October 2019 and September 2021 when former directors Steve Gray and Liza Estlund Olson were at the helm. Dale become director last October after Gray resigned in November 2020 and Olson acted as interim director.
Additional performance audits on the Michigan UIA are currently in progress including on fraud and claims processing.
More on MLive:
Michigan judge to consider injunction to block collections on pandemic jobless aid
Michigan erases $431M in pandemic unemployment overpayments
Unemployment waivers bring relief to thousands. More Michiganders are still waiting.
Ad Choices